Former OCR Advisor on HIPAA Compliance and Data Breaches: “This is a Management Problem, Not a User Problem”

The Department of Health and Human Services’ Office for Civil Rights (OCR) has stepped up its enforcement activities in recent years, and 2016 was a very busy year in Health Insurance Portability and Accountability Act (HIPAA) enforcement activity. In fact, last year saw unprecedented levels of enforcement actions, fines and aggregate HIPAA penalties being assessed. This past year also saw HHS OCR launch Phase 2 of its HIPAA Privacy, Security and Breach Notification Audit program.

According to Law360, in 2016, payments of $23 million were made to OCR to resolve potential noncompliance with HIPAA Security and Privacy rules, which represents a 300 percent increase over the previous annual record of $7.4 million in 2014. There were 13 enforcement actions in 2016, a significant increase over the previous annual record of seven actions. In August, as previously reported by Healthcare Informatics, OCR announced the largest settlement to date, as Advocate Health Care Network agreed to pay $5.55 million in a settlement with HHS stemming from data breaches affecting the protected health information (PHI) of 4 million people.

And, so far this year, the upswing in HIPAA enforcement activity has continued. In February, Hollywood, Fla.-based Memorial Healthcare Systems (MHS) agreed to pay HHS $5.5 million to settle potential HIPAA violations stemming from two health system employees inappropriately accessing patient information. Additionally, in February, OCR fined Children’s Medical Center of Dallas $3.2 million due to data breaches resulting from the losses of encrypted mobile devices that contained unsecured ePHI of about 6,260 individuals, as reported by Healthcare Informatics.

There is a distinction between a settlement and a civil money penalty. In the case of Children’s Medical Center of Dallas, the fine was the result of what OCR described as the hospital’s non-compliance “over many years with multiple standards of the HIPAA Security Rule.” Further, OCR officials stated that despite Children's knowledge about the risk of maintaining unencrypted ePHI on its devices as far back as 2007, Children's issued unencrypted BlackBerry devices to nurses and allowed its workforce members to continue using unencrypted laptops and other mobile devices until 2013.

To date, it is unclear what the new Trump administration’s priorities will be with regard to HIPAA enforcement, yet the enforcement activities in 2016 and so far in 2017 should serve as a wake-up call to healthcare organizations regarding the importance of safeguarding PHI. And beyond complying with HIPAA Security and Privacy rules to avoid OCR penalties, security best practices also can help mitigate the risk of data breaches. David Holtzman, vice president of compliance strategies at CynergisTek, an Austin, Texas-based cybersecurity consulting firm, notes that surveys of consumer attitudes have consistently shown that patients lose trust in healthcare organizations that have breaches. “A healthcare organization is only as good as the trust its patients put in it,” he says.

David Holtzman

Holtzman previously served on the health information privacy team at the Department of Health and Human Services’ Office for Civil Rights (OCR/HHS), where he served as the senior advisor for health information technology and the HIPAA Security Rule. He recently spoke with Healthcare Informatics Associate Editor Heather Landi about HIPAA compliance issues, data security and why hospital executives need to sit up and take notice of OCR’s enforcement activity.

Last year, we saw record levels of enforcement actions from OCR. Why did we see a rise in enforcement action last year and will this continue?

I would actually pin this back to the middle of 2015 when we began to notice an uptick in the OCR’s enforcement activity, and quite frankly, to give credit where credit is due, then-OCR director Jocelyn Samuels made it a priority to engage in a more aggressive stance to resolving enforcement actions at OCR with formal enforcement. OCR has always had the authority to enforce the HIPAA privacy and security and now the breach notification rules. Prior to the passage of the HITECH Act (The Health Information Technology for Economic and Clinical Health Act), OCR was directed to attempt to resolve matters informally through voluntary compliance. And the HITECH Act, with its increase of penalties for HIPAA violations, also directed that the agency would be able to keep any fines or penalties collected for use for health information privacy enforcement or education, and also required the agency to levy a penalty when it found willful neglect.

There also has been an increase in cyber criminals targeting the healthcare industry. Is the rise in OCR enforcement activity correlated to that?

The answer is no. When you look at the enforcement actions that are being taken by OCR, they are resulting from mostly incidents involving breaches that, at their root cause, are largely due to failure to perform an information security risk analysis or failure to safeguard ePHI stored on portable and mobile devices, like encrypting laptops, or broader management indifference to putting in place safeguards after their information security risk analysis identifies areas needing attention.

Does OCR prefer to settle and educate when it finds compliance problems?

Every year, OCR receives tens of thousands of breach reports and consumer complaints alleging incidents that could be violations of the HIPAA rules. It is administratively convenient to attempt to resolve cases where there are indications that organizations have not fully complied with the privacy or security rules, when in fact, statistically, OCR resolves more than 9 out of 10 compliance reviews informally through the voluntary compliance of the organization. Generally, the OCR enforcement actions will take place when there is evidence of some unreasonable amount of neglect or management indifference to having reasonable and appropriate policies, procedures or safeguards for PHI.

What are the regulatory implications for hospitals associated with these kinds of data breach incidents?

There’s a distinction between those organizations that choose to seek a resolution agreement and a correction action plan with the OCR. The resolution agreement calls for paying a set fine which is usually a greatly reduced amount than what could have been sought as a civil money penalty. So long as they carry out the actions called for in the corrective action plan. And the terms of corrective action plans can vary, but generally involve OCR supervision from one to three years, during which time, the covered entity or business associate must take certain specified steps to implement policies and procedures as well as conduct thorough information security risk analysis and lower the risk to PHI as indicated by the risks analysis. When OCR levies a civil monetary penalty, that civil monetary penalty requires the covered entity or business associate to pay a fine, but does not carry any obligation for the organization to mitigate its compliance state. In seeking formal enforcement, the rules governing how OCR and other federal agencies can levy a penalty require developing evidence that meets a very high standard of proof.

What are some best practices that hospitals can leverage to avoid OCR penalties for noncompliance and to mitigate their risk of breach?

To reduce the risk of breach, and to reduce your organization being a target to malware or ransomware or cyber incidents, there is no substitute for thorough enterprise-wide information risk analysis and developing a risk management plan to mitigate or address the gaps identified through the risk analysis. The second and equally important activity is to train your staff and physicians to be familiar with your organizations policies for safeguarding PHI as well as the real threat posed by email communications that masquerade as legitimate messages and that may contain links to malware. The best way to combat this scourge is through a phishing exercise that identifies those who are enticed to open these communications and then educate these workforce members on how to avoid the threat.

What are some of the policies, procedures and technologies organizations should be using to safeguard PHI on mobile devices and laptops?

This is not a user problem, this is a management problem. These are management failures. Managers who are responsible for information systems and information security must make sure they take the basic steps to inventory those devices which are handling electronic protected health information and to ensure that they are not capable of sharing or storing or creating PHI unless they have the appropriate safeguards to either encrypt the data that is stored or transmitted through the device, or they are physically protected from unauthorized access and loss.

Last year, OCR launched a new initiative aimed at giving its regional offices increased investigatory and enforcement authority to investigate small breaches [a breach impacting fewer than 500 individuals]. How will this impact healthcare organizations?

OCR’s information systems were upgraded earlier in 2016 to better manage and provide useful data of breaches under 500 [individuals] reported to OCR. Prior to this upgrade, data from small breaches was not readily accessible or indexed in a way that made it useful for enforcement activity. With the enhancement to OCR’s program information management systems, reports of small breaches contain the same information and are retrievable in the same manner as large breaches. This allows the regional investigators the ability to identify and review breach reports filed by a covered entity or business associate of small breaches, allowing for identifying trends and repeated instances of incidents of the same or similar cause. In reality, an organization that has suffered a large breach can expect to undergo scrutiny for incidents of small breaches it had also reported.

Do you think with the rise in OCR enforcement activity it will get the attention of data security leaders at healthcare organizations?

OCR’s activity is forcing executives to stand up and take notice. Nothing gets the attention of the C-suite like a seven-figure penalty or fine that is levied against an organization that is doing things the same way they are. It’s good business to safeguard your most important assets, which are the information that you are creating or maintaining about your most important activity, which is your mission of care, and providing healthcare or providing services to healthcare organizations.